CVE-2026-100563: OpenClaw npm Package CSV Injection Vulnerability

CVE-2026-100563 is a CSV injection flaw in OpenClaw npm package that allows formula injection through session data exports. Attackers can embed malicious formulas that execute when opened in spreadsheet applications. This article covers technical details, affected versions, impact assessment, and mitigation strategies.

CVE-2026-100563 Overview

CVE-2026-100563 is a CSV formula injection vulnerability in OpenClaw, distributed as the npm package openclaw, affecting all versions before 2026.8.1. The Control UI exports session data to CSV without neutralizing leading characters that spreadsheet applications treat as formulas. A lower-trust participant who can influence a session label or the first user message can place formula-like content into the Usage export. If an operator later opens the file in a spreadsheet application with formula evaluation enabled, the cell may execute with the spreadsheet user's permissions. The maintainers fixed the issue in release 2026.8.1.

Critical Impact
Attacker-controlled session labels can trigger spreadsheet formula execution on an operator's workstation when CSV exports are opened with formula evaluation enabled.

Affected Products

OpenClaw (npm package openclaw) versions prior to 2026.8.1
OpenClaw Control UI CSV Usage export functionality
Downstream deployments embedding the openclaw package

Discovery Timeline

2026-09-26 - CVE-2026-100563 published to NVD
2026-09-28 - Last updated in NVD database

Technical Details for CVE-2026-100563

Vulnerability Analysis

The vulnerability is a CSV injection issue classified under [CWE-1236: Improper Neutralization of Formula Elements in a CSV File]. OpenClaw's Control UI generates a Usage export that contains session labels and user message content supplied by session participants. The export routine quotes values as CSV text but does not strip or escape leading characters such as =, +, -, @, tab, or carriage return. Spreadsheet applications including Microsoft Excel, LibreOffice Calc, and Google Sheets interpret those prefixes as formula indicators. OpenClaw itself never evaluates the content; the risk materializes only in the downstream spreadsheet client. Realized impact depends on the receiving application's formula evaluation settings and macro trust configuration.

Root Cause

The CSV serialization logic treats quoting as sufficient sanitization. It does not apply a leading-character neutralization step such as prefixing suspicious cells with a single apostrophe or stripping formula triggers. Participant-controlled fields flow directly into operator-facing exports.

Attack Vector

A lower-trust participant sets a session label or first user message beginning with a formula character followed by a payload such as a HYPERLINK, WEBSERVICE, or DDE expression. An operator exports Usage data from the Control UI and opens the CSV in a spreadsheet client. If formula evaluation is enabled, the cell runs under the operator's identity and can exfiltrate data, trigger network requests, or initiate command execution via spreadsheet-specific vectors.

No verified public exploit code is available. See the GitHub Security Advisory GHSA-xx9p-hc9w-6p5h and the VulnCheck Advisory for OpenClaw for additional technical context.

Detection Methods for CVE-2026-100563

Indicators of Compromise

CSV exports from OpenClaw containing cells beginning with =, +, -, or @ in session label or message columns.
Outbound network connections from spreadsheet application processes (excel.exe, soffice.bin) shortly after an operator opens an OpenClaw Usage export.
Child processes such as cmd.exe or powershell.exe spawned by a spreadsheet application following CSV import.

Detection Strategies

Hunt for process-lineage events where a spreadsheet application is the parent of a shell, scripting host, or rundll32.exe invocation.
Inspect OpenClaw session metadata at ingest for participant-supplied labels or first messages beginning with formula trigger characters.
Correlate CSV download events from the OpenClaw Control UI with subsequent anomalous activity on the downloading operator's workstation.

Monitoring Recommendations

Enable endpoint telemetry for Office and LibreOffice child-process creation and DDE channel initialization.
Log all Usage export actions in the OpenClaw Control UI, including the operator identity and session scope.
Alert on spreadsheet applications issuing outbound HTTP requests to non-corporate destinations.

How to Mitigate CVE-2026-100563

Immediate Actions Required

Upgrade the openclaw npm package to version 2026.8.1 or later across all deployments.
Audit existing CSV Usage exports for cells beginning with formula trigger characters before further distribution.
Disable automatic formula evaluation and DDE in operator spreadsheet clients used to review OpenClaw exports.

Patch Information

The issue is fixed in OpenClaw 2026.8.1. Refer to the GitHub Security Advisory GHSA-xx9p-hc9w-6p5h for the fix commit and release notes.

Workarounds

Restrict session label and first-message input to a vetted character set using an upstream proxy or input validation layer.
Open exported CSV files in a text editor or import them into a spreadsheet with formula evaluation disabled.
Configure Microsoft Excel Trust Center to block DDE server launches and disable WEBSERVICE and external data connections.

bash

# Configuration example
npm install openclaw@2026.8.1
npm ls openclaw